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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)^ Responsive to communication(s) filed on July 24, 2001 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-24 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) IEl Claim(s) 1-24 is/are rejected. 

7) Q Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
?)□ All b)Q Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1) ^ Notice of References Cited (PTO-892) 

2) O Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) ^ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/Mail Date . 



4) □ Interview Summary (PTO-413) 

Paper No(s)/Mail Date. . 

5) □ Notice of Informal Patent Application (PTO-152) 

6) □ Other: . 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 1-04) 



Office Action Summary 



Part of Paper No./Mail Date 1 



Application/Control Number: 09/911,989 
Art Unit: 2157 



Page 2 



Detailed Action 

1 . This action is responsive to the application filed on July 24, 2001 . Claims 1 -24 
are pending examination. Claims 1-24 represent method and apparatus for packet 
analysis in a network. 



Objection to Specification 



2. Applicant is reminded of the proper content of an abstract of the disclosure. 

A patent abstract is a concise statement of the technical disclosure of the patent 
and should include that which is new in the art to which the invention pertains. If the . 
patent is of a basic nature, the entire technical disclosure may be new in the art, and the 
abstract should be directed to the entire disclosure. If the patent is in the nature of an 
improvement in an old apparatus, process, product, or composition, the abstract should 
include the technical disclosure of the improvement. In certain patents, particularly 
those for compounds and compositions, wherein the process for making and/or the use 
thereof are not obvious, the abstract should set forth a process for making and/or use 
thereof. If the new technical disclosure involves modifications or alternatives, the 
abstract should mention by way of example the preferred modification or alternative. 

The abstract should not refer to purported merits or speculative applications of 
the invention and should not compare the invention with the prior art. 

Where applicable, the abstract should include the following: 

(1) if a machine or apparatus, its organization and operation; 

(2) if an article, its method of making; 

(3) if a chemical compound, its identity and use; 

(4) if a mixture, its ingredients; 

(5) if a process, the steps. 



Extensive mechanical and design details of apparatus should not be given. 
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Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(a) the invention was known or used by others in this country, or patented or described in a printed 
publication in this or a foreign country, before the invention thereof by the applicant for a patent. 

4. Claims 1-24 are rejected under 35 U.S.C. 102(a) as being unpatentable over 
Coss et al. US Patent No. 6,154,775. 

As to claim 1 , Coss et al., here after referred as Coss, teaches a method of 
monitoring traffic in a network comprising the steps of: 

receiving a data packet at a network interface (column 6 lines 28-29) further comprising 
a run-time system interacting with one or more processing blocks through an application 
programming interface (firewall); and processing information in the data packet at a 
processing block (column 6 line 28-column 7 line 9, processing blocks for filtering IP 
packets), thereby generating output using the application programming interface which 
can be relayed from the network interface to the host (column 7 lines 8-9). 

As to claim 2, Coss teaches the network interface comprises a plurality of 
processing blocks and wherein a plurality of outputs are generated by the processing 
blocks which can be relayed from the network interface to the host (column 6 line 28- 
column 7 line 9, processing blocks for filtering IP packets before sending the packets to 
the appropriate interface). 
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As to claim 3, Coss teaches the processing blocks are generated from a 
processing query expressed in a high-level language (column 4 lines 20-26, wherein 
Coss teaches an asterisk which is used as a wildcard in high-level language such as 
SQL, is used for wildcard entries to search/filter out the category in the rule table). 

As to claim 4, Coss teaches the processing query accesses functions defined in 
the run-time system (column 8 lines 35-40). 

As to claim 5, Coss teaches the outputs are condensed statistics of network 
performance (column 5 line 58). 

As to claim 6, Coss teaches the processing block performs filtering on the 
information in the data packet (column 5 line 36-column 7 line 27, processing blocks for 
filtering IP packets). 

As to claim 7, Coss teaches the processing block performs a transformation on 
the information in the data packet (column 4 lines 11-20, network address translation, 
encryption can be performed on the information in the IP packets). 

As to claim 8, Coss teaches the processing block performs aggregation on the 
information in the data packet (column 5 line 36-column 7 line 27, information in the IP 
packets are aggregated and stored in the cache). 
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As to claim 9, Coss teaches the run-time system can pass parameters to the 
processing block, thereby changing the processing performed by the processing block 
(column 8 lines 28-40, the IP packet processing performed by the processing blocks 
can be changed dynamically). 

As to claim 10, Coss teaches the run-time system can instantiate new processing 
blocks dynamically (column 8 lines 27-59, the processing performed by the processing 
blocks can be changed dynamically). 

As to claim 12, Coss teaches the data packet is an Internet Protocol datagram 
(column 6 lines 28-29). 

As to claim 13, Coss teaches an apparatus for monitoring traffic in a network 
comprising: 

a run-time system which can execute at a network interface and receive information 
from data packets in a network (column 6 lines 28-29) ; and one or more processing 
blocks interacting with the run-time system through an application program interface 
such that the processing blocks can process the information in the data packets 
(column 6 line 28-column 7 line 9, processing blocks for filtering IP packets) and 
generate output using the application program interface which can be relayed from the 
network interface to the host (column 7 lines 8-9). 
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As to claim 14, Coss teaches the apparatus comprises a plurality of processing 
blocks and wherein a plurality of outputs are generated by the processing blocks which 
can be relayed from the network interface to the host (column 6 line 28-column 7 line 9, 
processing blocks for filtering IP packets before sending the packets to the appropriate 
interface). 

As to claim 15, Coss teaches the processing blocks are generated from a 
processing query expressed in a high-level language (column 4 lines 20-26, wherein 
Coss teaches an asterisk "*", which is used as a wildcard in high-level language such as 
SQL, is used for wildcard entries to search/filter out the category in the rule table). 

As to claim 16, Coss teaches the processing query accesses functions defined in 
the run-time system (column 8 lines 35-40). 

As to claim 17, Coss teaches the outputs are condensed statistics of network 
performance (column 5 line 58). 

As to claim 18, Coss teaches the processing block performs filtering on the 
information in the data packet (column 5 line 36-column 7 line 27, processing blocks for 
filtering IP packets). 
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As to claim 19, Coss teaches the processing block performs a transformation on 
the information in the data packet (column 4 lines 1 1-20, network address translation, 
encryption can be performed on the information in the IP packets). 

As to claim 20, Coss teaches the processing block performs aggregation on the 
information in the data packet (column 5 line 36-column 7 line 27, information in the IP 
packets are aggregated and stored in the cache). 

As to claim 21, Coss teaches the run-time system can pass parameters to the 
processing block, thereby changing the processing performed by the processing block 
(column 8 lines 28-40, the IP packet processing performed by the processing blocks 
can be changed dynamically). 

As to claim 22, Coss teaches the run-time system can instantiate new processing 
blocks dynamically (column 8 lines 27-59, the IP packet processing performed by the 
processing blocks can be changed dynamically). 

As to claim 24, Coss teaches the data packet is an Internet Protocol datagram 
(column 6 lines 28-29). 
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Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claim 1 1 and 23 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Coss US Patent 6,498,782 in view of Branstad et al. US Patent 6,498,782. 

Coss teaches the invention substantially as claimed including method for a 
computer network firewall with dynamic rule processing with the ability to dynamically 
alter the operations of rules (see abstract). 

As to claim 1 1 , Coss teaches the method of claim 1 . Coss does not teach 
"Gigabit Ethernet network". However, Branstad teaches method and Gigabit Ethenet 
communications adapter are provided for implementing communications in a 
communication network (see abstract, column 3 line 39-column 4 line 3). 

It would have been obvious to one of ordinary skill in the art to modify Coss by 
including Gigabit Ethernet network as taught by Branstad because doing so allow the 
system to use/implement/take the advantage of the Gigabit Ethernet communication 
adapter to support the integration of high speed data traffic and to provide quality of 
service. 
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As to claim 23, Coss teaches the method of claim 13. Coss does not teach 
"Gigabit Ethernet network". However, Branstad teaches method and Gigabit Ethenet 
communications adapter are provided for implementing communications in a 
communication network (see abstract, column 3 line 39-column 4 line 3). 

It would have been obvious to one of ordinary skill in the art to modify Coss by 
including Gigabit Ethernet network as taught by Branstad because doing so allow the 
system to use/implement/take the advantage of the Gigabit Ethernet communication 
adapter to support the integration of high speed data traffic and to provide quality of 
service. 

Contact Information 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Amy Tran whose telephone number is (571) 272-4243. 
The examiner can normally be reached on M-F from 9:00am to 5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ario Etienne can be reached on (571) 272-4001. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

November 12, 2004 
at 




PRIMARY EXAMINER 



